0

I am working on a packed file with UPX.
In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0.
enter image description here

The debugger auto-completes it to kernel32.LoadLibraryA.
Where can I verify that this is the address of the function?

I looked at the "Memory Map" tab but all I can see is the address (0x777F000) of the kernel32.dll module:
enter image description here

Is there a place I can view the addrresses of all the functions related to a specific module?

EDIT:
I tried Search for > All Modules > Intermodlar calls:
enter image description here

I searched for LoadLibraryA (address 0x778057c0) but it doesn't find it:
enter image description here

Improve this question

1 Answer 1

Reset to default
1

You can either press Ctrl+G and type LoadLibraryA to land at this function address, or if you want to list all the functions from kernel32.dll you can go to the Symbols tab like this:

enter image description here

From there you can view the function address or just double-click "LoadLibraryA" to follow it in disassembler.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.